Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1e1b46485102a47…

MALICIOUS

PDF

36.1 KB Created: 2020-08-31 02:39:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a7b58d2ae42be33a1a5035b220f461a9 SHA-1: 3b56b43e23d68f7bdfe7c16a73ee13dc6f6d3938 SHA-256: c1e1b46485102a470f31a6d09e2547800f202a24e391497f353128da4a90f42e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF contains a link to a known malicious redirector, ttraff.cc, which is likely used to deliver a payload. The document body contains text related to 'Fallout 4 lockpicking too fast' and includes the malicious URL, suggesting a lure to trick the user into clicking the link. The presence of a large number of external PDF links also indicates a link farm, a common tactic for SEO poisoning to drive traffic to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=fallout+4+lockpicking+too+fast
    • https://static.usrfiles.com/ugd/b8c837_7639605d2e23480d8678cb82f7e0aed6.pdf
    • https://static.usrfiles.com/ugd/08fe48_e165b0360d6143e6bab7f423fc0ef2fe.pdf
    • https://static.usrfiles.com/ugd/0d2908_a004cf10d8514857b67f90372c83f573.pdf
    • https://static.usrfiles.com/ugd/48d9a1_651120da3d1944a7924a1555caf191ac.pdf
    • https://static.usrfiles.com/ugd/a382ee_88c8498cf84c4f888f673d976db71a1a.pdf
    • https://cdn.shopify.com/s/files/1/0432/1637/1867/files/redopafujesolinodo.pdf
    • https://cdn.shopify.com/s/files/1/0429/7352/8223/files/johnson_multivariate_analysis.pdf
    • https://cdn.shopify.com/s/files/1/0427/4556/1254/files/48787251912.pdf
    • https://cdn.shopify.com/s/files/1/0437/7015/1061/files/holt_mcdougal_avancemos_1_workbook_answers.pdf
    • https://static.usrfiles.com/ugd/a8ca0f_2d0bdbc763fd4589bb59c6e72e27b0ba.pdf
    • https://static.usrfiles.com/ugd/ee6770_be8a64fa9a584299a277393de91d3d25.pdf
    • https://static.usrfiles.com/ugd/87fdc7_99f9f66710f646c4a22e7b90a4961cd9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004f3e.bin
1f33719c41751c090fbddfe22d52fce7f1ae842f2221bf4ed854de639ec43cca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F3E 5192 bytes
font_01_sfnt_off00006113.bin
69de58eb2ac9e4b45310015d88572333a674e9ffaebbf68445e58b39702ec49e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6113 10212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.